.TH SSH2 1.SH NAMEssh, sshsession, sshtun, scp, rsa2ssh2 \- Plan 9 support for SSHv2.SH SYNOPSIS.B ssh[.B -CdriIvaxkKm][.B -l.I user][.B -n.I dir][.B -s.I subsystem][.B -z.I attribute=value]addr[.I cmd[.I args]].PP.B scp[host:]file [host:]file.br.B scp[host:]file ... [host:]dir.PP.B sshsession[.B -t][.B -n.I namespace][.B -R.I dir][.B -r.I dir][.B -s.I command][.B -S.I srvpt].PP.B sshtun[.B -9dk][.B -m.I mntpt][.B -s.I srvpt].PP.B rsa2ssh2[.I file].SH DESCRIPTIONThese programs collectively provide support for SSHv2 for Plan 9.It supports only SSHv2 and will reject connections with a remotesystem that supports only SSHv1.Both client and server operation is provided.All of the encryption, authentication, and SSH protocol are handledby a tunnel that is presented as a protocol directory in.B /net..SH "CLIENT OPERATION".I Sshand.I scpare the applications that provide normal client access to theSSH tunnel..I Sshdials a remote system and runs a shell (or some other command) there.In its simplest usage, it works like any other.I sshcommand line application.So the command:.IP.EXssh root@hannibal.EE.LPwill result in a command prompt on the machine.B hanniballogged in as.B root.To accomplish this,.I sshfirst looks to see if there is an ssh tunnel in.B /net,and if not, it runs.I sshtunwith no options.Using the usual technique of opening the.B clonefile and writing a.B connectmessage,.I sshdials the remote ssh server and exchanges encryption keys withthe server using Diffie-Hellman key exchange.A similar.B clonefile and.B connectmessage protocol creates a session in the established connection.In the course of session creation,.I sshfirst attempts to authenticate the user with the server usingpublic key authentication.If that fails, it then prompts for a password, and attempts toauthenticate with password authentication.It also passes across the value of the environment variable.B TERMas would be set if.I sshis run inside of.IR vt (1)..LPFollowing the convention in other Plan 9 communications applications,typing a control-\\ will result in a.B >>>prompt.There are currently only four commands that can be issued at thatprompt:.B Cto toggle cooked (local echo) mode,.B cto continue the.I sshsession,.B hto print a list of the available commands,.B rto toggle the supression of carriage returns, and.B qto close the session started by this instance of.I ssh..LP.I Sshcan take the following command-line options:.TP.B -CCooked mode, echo characters typed locally, this is useful onhigh latency links and allows the use of all of rio(1)'sediting facilities..PD 0.TP.B -dIncrease the amount of debugging output..PD 0.TP.B -lA deprecated method of specifying the user name on the remotesystem..PD 0.TP.B -rStrip carriage return characters coming from the remote system.This will normally be desired when running in a raw.IR rio (1)window or from within.IR winin.IR acme (1).It is normally not used when running.I sshfrom within.IR vt (1)..PD 0.TP.B -kSkip the attempt to authenticate using public key authentication..PD 0.TP.B -KDo not fall back to password authentication.If the public key authentication fails,.I sshwill exit..PD 0.TP.B -mRemove the special meaning of control-\\.This is needed by.I scpto prevent that character in files being copied from triggering thespecial command mode..PD 0.TP.B -nSpecify the network directory of an alternate network to use.The default is.B /net..PD 0.TP.B -sRequest an ssh2 subsystem on the remote server,this is used by.IR sftpfs (4)..PD 0.TP.B -zUsed to specify which of several possible keys to use..PD 0.TP.B -i -ISets.I sshto interactive.RB ( -i )or non-interactive.RI ( -I )mode.This determines whether the user is prompted for a passwordif none is found in factotum.Without either of these options,.I sshuses interactive mode if run in a term window..PD 0.TP.B -v -a -xAll no-ops but included for compatibility with.IR scp ..LPThe.I scpprogram does all its work by running.I sshto execute an instance of.I scpon the server, it functions normally with this implementation of.I ssh..SH "SERVER OPERATION"The.I sshsessionprogram provides the server functionality for SSHv2.It is suitable for running by.IR listen (8)Therefore, it is not normally run directly by the user.Like.I ssh,it does all of its communication through the tunnel..I Sshsessionhandles running a shell or a requested command when a remotesystem requests a new connection and session..LPOne can run a private ssh server by first setting up the tunneland then running the command:.IP.EXaux/listen1 -t ssh!*!2222 sshsession.EE.LPSimilarly, a system-wide ssh server can be run by includinga file called.B ssh22in.B /rc/bin/service.auth..LPWith no command-line options,.I sshsessionruns in a way suitable for the typical ssh server.Several aspects of its behavior can be changed, however,via the following options:.TP.B -sSpecify an alternative to.B /bin/rcfor shell sessions..PD 0.TP.B -rSpecify a starting directory for the ssh session to run in..PD 0.TP.B -RSame as.B -rbut additionally prevent any arguments on the command line tobe executed from referencing anything outside this directory.This is mostly used to limit where.I scpcan deposit or get files..PD 0.TP.B -nSpecify a.IR namespace (6)file to be used before starting the shell or running the requestedcommand.The default is.B /lib/namespace..PD 0.TP.B -SSpecify an alternative file in.B /srvwhere the tunnel can be found if it is not already mounted in.B /net..PD 0.TP.B -tSpecify that the sshsession instance is trusted and should run in thesame name space as the listen that started it..LPFor shell channels,.I sshsessionwill print the contents of.B /sys/lib/motdto the client, if that file is present..SH TUNNEL.I Sshtunis the program that implements the ssh tunnel used by.I sshand.I sshsession.It handles all the necessary work to implement SSHv2.The following options may be given to.I sshtun.TP.B -dIncrease the amount of debugging output..PD 0.TP.B -kUse.IR keyfs (4)for password validation..PD 0.TP.B -mMount point for the ssh protocol directory; defaults to.B /net..PD 0.TP.B -sName to post in.B /srv.If.B -sis not given, no file is posted to.B /srv..LPAccess to the tunnel is provided though a protocol directory.B /net/ssh.This directory contains a set of numbered directories, each of whichis an ssh connection that is curently active or has been used in thepast.It also serves the files.B clone,.B ctl,and.B keys..B Clonebehaves like the.B clonefiles in other protocol directories.In particular, opening it reserves an ssh connection, reading fromit gets the connection number reserved, and writing to it writesto the.B ctlfile in the numbered connection directory.Reading the.B ctlfile returns the most active state of any connection.There are currently no commands that can be written to.B /net/ssh/ctl.Finally, the.B keysfile is used by.I sshto relay information about keys and passwords between a userand the tunnel..LPEach of the numbered connection directories also containsa set of numbered directories, one for each channel used onthat connection.It also contains the files.B clone,.B ctl,.B data,.B listen,.B local,.B remote,and.B status.Similar to the top-level.B clonefile, opening a connection's.B clonefile reserves a channel and gives access to its.B ctlfile.Reading from the.B ctlfile gives the connection number (also the name of thatdirectory).Several commands are available to write into a connection's.B ctlfile:.TP.B connectThis command dials the remote system and carries out the initialhandshake to exchange versions, lists of supported algorithms,and to establish the encryption keys to use..PD 0.TP.B ssh-userauthAttempt to authenticate a user with the remote system, with eitherpublic key authentication or a password..PD 0.TP.B ssh-connectionCurrently unsupported..PD 0.TP.B hangupShut down a connection and all of its channels..PD 0.TP.B announceAnnounce the tunnel's willingness to accept connection requests fromremote systems..PD 0.TP.B acceptDo the initial connection handshake with the remote system..PD 0.TP.B rejectSend back a connection rejection message and shut down the connection..LPBecause data is always carried over a channel, the connection data fileis not used for usual data.However, reads from the connection data file do return the capabilityneeded for.I sshsessionto change identity to the user logging in.As with other protocol directories, opens on.B listenblock until a remote system establishes a connection, at which point,the application should write either an.B acceptor.B rejectmessage to the.B ctlfile.The.B localand.B remotefiles give the IP addresses and port numbers of the local and remotesystems.The connection.B statusfile gives the status of the channel with the status closest to.B Established..LPEach channel directory contains the files.B ctl,.B data,.B listen,.B request,and.B status.As with connections, reads from channel.B ctlfiles return the channel number.Commands that may be written to a channel.B ctlfile include:.TP.B connectInitiate the establishment of a new channel over this connection.SSHv2 defines.B session,

Lines 1–500 of 784. Load more